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Abstract—This paper describes the power and command 
system architecture of the X-57 Maxwell flight demonstrator 
aircraft. The X-57 is an experimental aircraft designed to 
demonstrate radically improved aircraft efficiency with a 3.5 
times aero-propulsive efficiency gain at a “high-speed cruise” 
flight condition for comparable general aviation aircraft. These 
gains are enabled by integrating the design of a new, optimized 
wing and a new electric propulsion system. As a result, the X-57 
vehicle takes advantage of the new capabilities afforded by electric 
motors as primary propulsors. Integrating new technologies into 
critical systems in experimental aircraft poses unique challenges 
that require careful design considerations across the entire vehicle 
system, such as qualification of new propulsors (motors, in the case 
of the X-57 aircraft), compatibility of existing systems with a new 
electric power distribution bus, and instrumentation and 
monitoring of newly qualified propulsion system devices. 
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I. INTRODUCTION 


The National Aeronautics and Space Administration 
(NASA) Scalable Convergent Electric Propulsion and 
Operations Research (SCEPTOR) project is demonstrating 
radically improved aircraft efficiencies with the X-57 Maxwell 
flight demonstrator aircraft. In order to achieve the 3.5 times 
aero-propulsive efficiencies, a Tecnam P2006T (Costruzioni 
Aeronautiche Tecnam S.r.1., Capua, Italy) airframe was chosen 
as the baseline aircraft. The aircraft will be retrofitted with a high 
aspect-ratio wing, the internal combustion engines will be 
replaced with electric motors and relocated to the wingtips, an 
array of smaller electric motors and propellers will be integrated 
into the leading edge of the wing, and the fuel tanks will replace 
with batteries (see Fig. 1). The X-57 flight demonstrator aircraft 
was designed using propulsion airframe integration (PAI) 
techniques that have long interested aircraft designers but were 
heretofore impractical due to the limitations of more traditional 
propulsion systems. For example, turbine and piston engines 
designed for the small scales required for these PAI 
opportunities cannot achieve specific power and efficiency as 
high as can larger systems. This condition reduces the gains 
achieved from PAI when using traditional, hydrocarbon-based 
powertrains. Improvements in the performance of electric 
propulsion powertrains make these PAI techniques practical, 
enabling an overall improvement of aircraft energy usage and, 
therefore, operating costs. 


Integrated design for effective interaction between the wing 
and the propellers is the core demonstration effort on the X-57 
flight demonstrator aircraft; recent advancements in 
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high-performance electric motors, motor controllers, and battery 
management technologies enable this new design paradigm. The 
X-57 will be the first electrified X-plane and because of the 
electric powertrain that is central to the capability being 
demonstrated here, the aircraft has been designated Maxwell in 
honor of James Clerk Maxwell’s foundational work describing 
the nature of the electromagnetic forces that are harnessed in the 
electric motors, motor inverters, power buses and batteries that 
comprise the X-57 traction system. 


Il. SCOPE 


This paper describes the design of the X-57 avionics power, 
traction power, and command systems for optimized system 
reliability given the constraints of a flight research program 
showcasing experimental hardware in critical systems. The 
system architecture relies on redundancy throughout the design 
to limit the scope of failures, component testing to limit the 
likelihood of failures, and failure analysis and training to limit 
the persistence of failures. Design decisions throughout the 
development of the X-57 traction system have been based on 
these principles and may serve as a case study for development 
of future experimental aircraft and potential commercial aircraft 
exhibiting these technologies. Power and command system 
redundancy is a key feature for limiting the impact of faults 
along the command and data handling pathways, the traction 
power buses, the energy storage medium, and the main vehicle 
motors. Evaluation of each developmental component by way of 
component independent design review, endurance testing, and 
function validation in the integrated system are essential to 
ensuring reliability. The integrated X-57 system design will be 
evaluated for failure modes and will be integrated into an aircraft 
simulator with a flight-like cockpit that will be used for pilot 
training, ensuring rapid response to the most severe fault cases. 


Fig. 1. X-57 Isometric model with centerline cut, showing battery system, 
high aspect ratio wing, electric motors, and traction power bus. 


ll. SYSTEM DESIGN OVERVIEW 


Development of the X-57 research systems has been staged 
into four configurations (Mods I-IV), each of which increases in 
complexity over the course of the research program. This 
approach enables researchers to evaluate the baseline 
performance and handling qualities of the unmodified aircraft in 
Mod I, the experimental propulsion system dynamics and 
reliability in Mod II, the high-performance, high aspect-ratio 
wing in Mod III, and the distributed electric propulsion system 
in Mod IV. By deploying the traction power, avionics power, 
and command systems in Mod HI, the integrated system 
performance of these systems can be studied in a flight-proven 
airframe configuration with ample rudder authority and flexible 
center of gravity (CG) placement. Thus, by the time the PAI 
features are being evaluated in Mod III and Mod IV, the 
electrical systems will be well understood and reliable as a result 
of the extensive experience gained operating the traction power, 
avionics power, and command systems during the Mod II 
ground- and flight-testing program. 


The X-57 traction system beginning in Mod II consists of 
two independent battery packs, redundant power distribution 
buses, and two cruise motors. Each cruise motor is rated for 255 
Nm and up to 2700 rpm (72 kW), shown in Fig. 2, and powered 
by two independent motor torque controllers which convert the 
DC power provided by the batteries to switched AC power based 
on the torque commanded by the pilot. Details of the cruise 
motor design and development process are described in [1] and 
[2]. The battery packs are a custom design that uses commercial 
off-the-shelf (COTS) lithium-ion 18650 cells arranged into four 
large (approximately 100 Ib.) modules per pack. Each of the two 
battery packs supply approximately 23 kWh of usable capacity 
and operate independently from each other. In the event of a 
failure in one of the redundant systems, either pack can each 
provide sufficient power for a controlled return to base. 


Redundancy throughout the design of the traction power, 
avionics power, and command system is a critical tool for 
ensuring minimum required thrust is available in the event of 
any single fault condition on this experimental flight 
demonstrator. Fig. 3 shows how the traction power system 
redundancy approach has been used to design for two 
independent vehicle batteries, traction buses, and motor torque 
controllers for the main cruise motors. This approach is critical 


Fig. 2. The X-57 Cruise Motor prototype and variable-pitch propeller before a 
test run. Photograph credit Joby Aviation. 


for the X-57 design because the cruise power system is located 
at the wingtips in order to achieve improved propulsive 
efficiency. Nominally, this wingtip configuration provides much 
improved performance of the main propellers, but this 
configuration also increases the complexity of designing for the 
single-motor-out failure case because a failure of one of the 
cruise motors or propellers introduces a large yaw moment due 
to asymmetric thrust. The redundancy approach of each of the 
systems described in this paper limits the majority of those 
failure cases to compromising less than 50 percent of the 
available thrust at either cruise motor. Similarly, for the Mod IV 
Distributed Electric Propulsion (DEP) system driving 12 
propellers along the leading edge of the wing (six on each side) 
to achieve high lift at low airspeeds, a redundant architecture is 
critical to reducing the severity of single-failure modes. 
Asymmetry in the induced velocity of air across the left wing 
versus the right wing can cause roll or yaw of the aircraft and a 
resultant loss of lift. The redundancy approach limits the effects 
of these failures to primarily avoid asymmetric upsets, and 
secondarily to limit the magnitude of the failure to no more than 
three of the propulsors for most cases (because no more than 
three of the motors in the DEP system on each side of the wing 
share a bus). 


The traction and command systems developed for the X-57 
aircraft are intentionally kept as simple as possible to minimize 
the development risks associated with complex systems and to 
simplify testing and integration. Most of the components are 
COTS products or are slightly modified from COTS products. 
Although the goal is to use parts that are of high technology 
readiness level (TRL) and already available in the marketplace, 
some such items are not suitable because of the demanding 
performance requirements for the X-57 or because of specific 
application needs. The cruise motors and torque controllers are 
being developed for this vehicle by Joby Aviation (Santa Cruz, 
California). The main vehicle battery system is being developed 
by Electric Power Systems Inc. (Industry, California). The X-57 
acceptance and qualification test plan is designed to screen each 
component with a level of investigation appropriate to 
identifying manufacturing defects and design flaws before 
integration into the X-57. 
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Fig. 3. X-57 Redundant Traction Power System. 


IV. AVIONICS POWER SYSTEM 


The X-57 avionics power system is designed to provide a 
piloting experience similar to that of the Tecnam P2006T, the 
aircraft from which the X-57 flight demonstrator is derived. The 
approach to the design involves maintaining as many of the 
existing avionics systems as possible, allowing, to the extent 
safely possible, the use of established procedures identified in 
the relevant Pilot Operating Handbook. The stock configuration 
follows the approach of many twin engine aircraft by cross- 
strapping the engine generator buses to a main bus which is 
backed up by a battery. This method allows the operation of 
esential aircraft avionics systems such as instruments, landing 
gear, and flaps in the event of many types of system power loss. 
The avionics power buses can be powered from either the left or 
right generator buses, or the battery backup. Loads can be shed 
by opening the cross-strap switches or the left and right avionics 
buses, affording the pilot many options in the event of various 
avionics power system failures. 


The X-57 flight demonstrator follows the same approach, 
maintaining many of the existing switches, wiring, circuit 
breakers, and relays of the Tecnam P2006T. As shown in the X- 
57 avionics power system interconnect (Fig. 4), the left and right 
generator buses are fed by the aircraft traction battery system. 
The traction battery consists of two battery packs (A and B). 
Because the battery packs have a nominal voltage of 461 VDC, 
the traction battery system implements two DC/DC buck 
converters (one for each battery pack) to generate 14 VDC 
avionics power which feeds the left and right generator buses 
from the A and B batteries, respectively. Each buck converter is 
sized for the entire avionics bus load. The stock aircraft backup 
battery remains connected to the essential bus to provide 
essential avionics power in the event of a traction battery failure 
or shutdown. Avionics power can also be supplied from the 
aircraft external power socket for ground-testing operations. 


Notable differences between the Tecnam P2006T and the 
X-57 flight demonstrator are the instrumentation bus and the 
new wing avionics buses. The instrumentation bus is fed from 
the aircraft right generator bus by way of a DC/DC boost 
converter in order to generate 28 VDC used for instrumentation. 
The wing avionics buses A and B are added to facilitate the 
redundancy in the cruise motors. The dual core windings in the 
cruise motor are nominally powered by two separate cruise 
motor controllers. Each wing avionics bus provides power to the 
cruise controllers in the left or right wing. Each motor controller 
in the left and right wings is fed by the A and B battery pack 
separately via the wing avionics buses, allowing shutdown or 
failure of either individual battery or wing avionics bus with 
continued operation of the motor at reduced power with one 
remaining controller. 


To effectively communicate warnings to the pilot about 
faults in the new avionics power and traction power systems, the 
Tecnam P2006T annunciator panel was customized. The new 
annunciator panel configuration, is shown in Fig. 5. The A and 
B avionics warning lights are triggered by a fault indication from 
the DC/DC buck converters in the traction battery system. A 
typical response to this warning would be to shut down the 
avionics side with the fault, and continue operations on the 
opposite side. A low-voltage indication from either of the main 
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Fig. 4. The X-57 avionics power system interconnect. 
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Fig. 5. The X-57 annunciator panel with electric propulsion system indication. 


traction battery sides is considered a critical fault. Depending on 
other factors, the response may be the shutdown of the offending 
battery side and immediate return to base with reduced motor 
performance. These annunciator panel warnings are in addition 
to other warnings that are part of the command bus system, 
including fault notification via the multi-function display and 
audio alarms. 


V. TRACTION POWER SYSTEM 


The X-57 traction power system is designed to safely and 
reliably provide power to the motor torque controllers and 
ensure that enough power would remain available to safely land 
the aircraft in the event of single-point failures. This is achieved 
by using redundant power buses, physical separation of cabling 
and conduits, and electronically controlled power contactors for 
safe operation of the motor controllers. 


While definitive guidelines exist for designing a safe and 
reliable traction power system, certified, airworthy electric 
aircraft propulsion systems for manned flight are a relatively 
new design space. There is little precedent or documentation to 
define proper standards. Existing Federal Aviation Regulations 
(FARs), such as Part 23 and Part 25, or Aeronautical Radio, 
Incorporated (ARINC) 400 series standards provide only basic 
wiring standards and limited guidance can be inferred from 
turbine or gas engine regulations. Designing the X-57 traction 
power system necessitated evaluating the system as a whole to 
implement standard aircraft features and capabilities. Once a 
functional system was developed, the available standards were 
combined with best practices to implement each subsystem. 


One such subsystem is the traction power cabling which 
includes standard aircraft features such as redundancy and 
isolation. The Mod II/III traction power bus for the X-57 is 


divided into two independent A and B buses that are each 
subdivided between the left (A/L and B/L) and right (A/R and 
B/R) side of the aircraft, as shown in Fig. 3. Each bus (A and 
B) is independently powered by an electrically-isolated battery. 
This architecture provides redundancy to the cruise motors in 
the event one of the buses fails. The buses are additionally 
isolated from each other, within the wing, each bus running 
inside dedicated conduits. This isolation aids in preventing 
cascading bus failures. Driving each cruise motor are two motor 
torque controllers, commonly referred to as the cruise motor 
controller (CMC). Each bus feeds one of the CMCs for one 
cruise motor. This technique follows the same redundant design 
philosophy that given any single-point failure, each cruise motor 
can still operate under the command of a single CMC. 


Contactor pallets are installed in the traction bus cabling 
between the batteries and the motors. There are two contactor 
pallets (A and B) located in the fuselage of the aircraft 
corresponding to the associated A or B bus. Each pallet contains 
sensors and electrical components to complete or interrupt the 
circuit to the motor controllers. To safely power on the CMCs 
and avoid inadvertently energizing the traction bus in the wing, 
custom pre-chargers with integrated, aircraft-grade contactors 
are used on the pallets. The pre-chargers control the voltage in 
the traction bus to restrict the inrush current and the contactors 
allow remote switching of the power from the traction bus. 
Current and voltage sensors within each pallet are used to 
measure the total energy consumption rate and total energy 
consumed. Isolation of the A and B buses is maintained with two 
contactor pallets physically placed on separate sides of the 
aircraft. This arrangement prevents failure of components within 
one pallet from cascading to the other pallet. 


The wire used for the X-57 traction bus cable is unique in 
that it is custom designed to address several challenges. 
Minimizing weight is inherently important, so using small- 
gauge wire is necessary. Wire that is too small, however, is a 
safety concern because of the potential for wires to overheat. 
Each electric cruise motor is designed to run at a total power of 
60 kW with each CMC nominally drawing 30 kW. The design 
of the X-57 batteries calls for lithium-ion cells in a series/parallel 
configuration combined with a depth-of-discharge limitation 
that drives the voltage range between 416 VDC and 525 VDC. 
To size the traction cable, we assume that each bus (A/L, A/R, 
B/L, B/R) must carry 30 kW, which results in a current ranging 
from 57 A to 72 A for each bus. Derating factors for altitude and 
number of conductors in a bundle are determined using [3] 
which relates wire size (in American wire gauge, AWG) to the 
expected temperature rise. The X-57 design uses four flat 
10-AWG conductors that are equivalent to 4-AWG as shown in 
Fig. 6. These current limits only allow 4-AWG if the cable is 
able to reject heat to ambient air. If the air temperature is allowed 
to rise due to high-current operation of the wire, the 4-AWG 
wire may fail. In this design example, aerospace standards do 
exist, however, those standards fail to take into account 
considerations from a systems perspective. This standard 
provides a good first approximation, but model-driven 
engineering (MDE) can refine the design further. Initial 
application of the SAE standard estimated that 2-AWG would 
be required for nominal operation. Additionally, it is possible to 
over-drive the CMC in response to some system failures, which 


would require pulling more than the nominal design current 
through a single bus. In this case, the SAE standard estimates 
that 2-AWG is required. Taking the MDE approach, a 
specialized 4-AWG cable with a high-temperature jacket was 
selected. The traction bus conduits are fabricated from a 
thermally-conductive composite material and are thermally 
isolated from the wing structure. In practice, the time spent 
operating at elevated temperatures will be monitored and limited 
as needed to prevent damage to the traction bus. Tests on the 
traction bus cable with X-57 flight profiles are being conducted 
using the NASA Electric Aircraft Testbed (NEAT) at the NASA 
Glenn Research Center (Cleveland, Ohio) in order to better 
quantify the performance of the cable. 


Radiated electromagnetic interference (EMI) from the 
traction bus is an additional design challenge, and can interfere 
with other systems on the vehicle. The traction system may 
exhibit high frequency interference due to inverter switching 
events or lower frequency noise related to motor field rotation. 
To mitigate this, several traditional shielding methods were 
considered, but the custom wing in the Mod III configuration 
has very limited space, so it was not possible to use shielded #4 
AWG wires for the traction bus. However, the custom cable 
described in Fig. 6 meets the space requirements. This cable 
comprises four adjacent 10-AWG wires, creating a flat cable 
that is four times wider than it is tall. The manufacturer claims 
that this configuration reduces the inductance and radiated noise 
as compared to an equivalent round wire, and modeling of these 
cable configurations supports this claim, as presented in Fig. 7. 
To test this performance, the NEAT facility conducted 
qualitative testing to assess radiated emissions on candidate 
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Fig. 6. The X-57 annunciator panel with electric propulsion system indication. 
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Fig. 7. Near-field electric and magnetic field strength comparison between 
traditional two-conductor cable and the X-57 “flat cable” configuration. 


cabling for the X-57 flight demonstrator. The NEAT test setup 
has a 125-kW motor-inverter and DO-160 line impedance 
stabilization network equipped for radio frequency emission 
measurement. Testing indicated that there was no significant 
difference in radiated emissions between the baseline shielded 
cable and the unshielded cables described in Table I; however, 
emissions are sensitive to the specific equipment being tested. 
The flat cable was selected because that cable fit the geometry 
restrictions in the Mod III wing without noticeable EMI 
concessions. There may be a benefit given the ability to tightly 
stack the supply and return cables to cancel radiated fields. 


VI. COMMAND SYSTEM 


A. Overview 


The X-57 command bus is used to control the electric motors 
and provides aircraft health and status. The command flow 
consists of throttle encoders (TEs) which digitize the existing 
Tecnam throttle lever positions and the electric motor 
controllers, which use this position as a torque target. The 
architecture of the bus follows the Controller Area Network 
(CAN) standard and includes both standard CAN messages and 
the higher-level CANopen protocol. The CAN protocol offers 
various benefits including error detection, message arbitration, 
multicast reception, and prioritization [4]. The single-wire pair 
required for the CAN physical layer and a lack of a bus 
controller simplify implementation. All devices on the X-57 
command bus adhere to the CAN2.0A standard and operate at 
1,000 kbaud. The CANopen system is a higher layer protocol, 
allowing configuration of nodes and defining the internal device 
structure of each device on the network [5]. Since CANopen is 
a higher layer of protocol built on CAN, components using the 
CANopen protocol can interoperate on a bus with components 
that communicate with standard CAN messaging. 


The components of the command bus were selected based 
on robustness and compatibility with the CAN bus. Because 
some components use the CANopen standard, precautions were 
taken to ensure the components using the standard CAN 
protocol do not interfere with the additional functionality of the 
CANopen devices. The CANopen protocol uses a portion of the 
message identification (first 4 bits of the message ID) of the 
CAN structure to identify configuration parameters and data 
parameters. By considering the data parameter identifiers used 
by CANopen, and carefully selecting the device identifications 
both for the CANopen and standard CAN devices, message 
collisions between the two standards is prevented. A diagram of 
the command system network is shown in Fig. 8. 


B. Components 


The battery management system (BMS) is a custom solution 
built by Electric Power Systems (EPS). It uses a CANopen 
standard that has been customized to fit with the X-57 CAN 
architecture. The BMS provides battery health and status 
information to the CAN bus, which can help convey relevant 
information to the pilot. 


The CMC is a custom solution provided by Joby Motors 
(Santa Cruz, California) and uses a CAN interface. The motor 
controller communicates health and status information for itself 


TABLE |. NEAT FACILITY EMI CABLE TEST MATRIX 
Cable _ Manufacturer Part number Configuration 
1 Champlain EXRAD-XLX2X Round/Shield 
2 TE Connectivity ©WMSHF260-0113-2-9 Round/Unshield 
3 Methode CD-0322-1B Flat/Unshield 


and the motor, including torque, speed, and temperatures, that 
can be used to provide situational awareness to the pilot. 


The MoTeC synchronous versatile input module (SVIM) is 
an analog to digital converter that transmits the data on a CAN 
bus. These modules collect data at high rates (5000 samples per 
second) and high resolution (15-bit) synchronously with other 
modules as needed. For the X-57 application, these modules are 
used to record the blade pitch angle and temperatures associated 
with the CMCs and the motors. The size and capability to 
transmit on CAN make these devices useful in an EMI 
environment research capacity. 


The MoTeC Pty Ltd (Melbourne, Australia) D175 is a 
full-color, customizable display and is the main interface 
between the pilot and the command bus. Fig. 9 shows s sample 
screen of the display. These screens show health and status 
information from the BMS, CMC, and TEs while also showing 
warnings and alarms based on the values from these systems. 
The screens are toggled with switch inputs incorporated into the 
display. Along with the situational awareness provided by this 
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Fig. 9. The X-57 cockpit display reflects the duality of the X-57 system 
design. Indicators include State of Charge, discharge rate, and throttle position. 


display, the screens provide additional information that aid in 
troubleshooting on the ground and quickly diagnosing problems 
in the air. The two main pages for the pilot are toggled using a 
simple switch, while the remaining pages are accessed by 
combining the switch with an eight-position rotary switch. This 
setup allows 16 different pages with information about the 
health and status of various X-57 components. 


A MoTeC advanced central logger (ACL) works as the 
processor for the display. The logger collects all of the relevant 
signals, performs mathematical operations on them, and feeds 
the results to the display. As such, the logger is used to determine 
the health and status of the battery and motors and to provide 
any alarms or warnings to the pilot by way of the display. The 
ACL also controls the light-emitting diode (LED) lights on the 
D175 display that provide quick information to the pilot, such as 
battery state-of-charge (SOC) or emergency location. Finally, 
the ACL serves as the interpreter for the SVIMs. The SVIM 
transmits data on the CAN bus in a proprietary format that is not 
easily interpreted by the instrumentation stack. Therefore, data 
that come from the SVIM are read by the ACL and then 
retransmitted to the command bus for the instrumentation stack 
to record. Since the instrumentation stack time-tags all the data 
being recorded, there is an inherent delay between the time when 
the SVIM transmits the data and the instrumentation stack 
records the data after ACL retransmission. This delay is 
acceptable because of the slow rate of change of the data being 
collected by the SVIM. 


The two throttle encoders used in the project are Baumer Ltd. 
(Southington, Connecticut) rotary encoders that are CANopen 
compliant. These devices measure rotation of the stock Tecnam 
throttle levers and put the data on the CAN bus. Each device also 
has dual encoders to provide greater reliability. 


Western Reserve Controls (WRC) (Akron, Ohio) fiber optic 
bus extenders (FOBEs) are commercial products that are 
customized for X-57 by repackaging for fit and robustness 
requirements. These bus extenders convert the electrical signals 
on the copper CAN bus to optical signals on fiber optic cables 
and convert them back to electrical signals on a copper segment 
closer to remote CAN components. The distance of the CMCs 
from the rest of the CAN bus components, and their use of high 
current to run the motors, present a higher risk of EMI in the 
copper CAN bus segments. This risk is mitigated by separating 
the segments with FOBEs and fiber optic cables. Using fiber 
optic cables also reduces the risk of reaching the line-length 
limits of the CAN bus standard and susceptibility radiated EMI 
from the traction power bus. 


A CAN-controlled relay box is a product by Blink Marine 
(Milan, Italy) that allows relays to be opened and closed using 
CAN messages. This provides an audio annunciator capability 
that can provide key alarms to the X-57 pilot. These alarms are 
defined collaboratively with the test pilots, system designers, 
and operations team. The audio annunciator works by grounding 
specific inputs to the device, resulting in output in the form of 
an audio message. CAN messages from the ACL to the relay 
box energize relays which completes the circuit to the 
annunciator, allowing the ACL to determine any alarm states 
and to alert the pilot both audibly (through the audio 
annunciator) and visually (through the D175 display). The audio 


annunciator that uses the relay box is a PRD60 accessory device 
developed by PS Engineering (Lenoir City, Tennessee). The 
device contains six pre-programmed messages and the ability to 
mute messages by acknowledging them with a simple 
push-button. 


The X-57 instrumentation system contains a CAN bus 
monitoring card that will interface to the command system. This 
card is used to only listen to the traffic on the CAN bus and 
record all of that traffic with a time tag. A subset of these 
messages is also transmitted to the ground station. 


C. Risk Mitigation 


The X-57 command bus is considered a mission-critical 
system, but not a safety-critical system. This designation is 
possible because the pilot does not need to rely on the command 
bus for the safe operation of the X-57 flight demonstrator 
aircraft. All of the safety-related information provided by the 
CAN bus is also independently measured and displayed on the 
right-hand instrument panel in the cockpit. The X-57 aircraft is 
also designed with an unpowered reversion mode in which the 
pilot can safely control the aircraft and complete an unpowered, 
higher speed landing. This capability is facilitated by limiting 
flight to the area over Rogers dry lakebed (Edwards, California), 
which provides ample landing options. 


Although the command system itself is not safety-critical, 
the CMC and BMS, which are safety-critical components, do 
interface with the command bus. A command bus failure for the 
X-57 flight demonstrator aircraft could result in a loss of 
communication to and from the BMSs or CMCs. Therefore, the 
BMS and CMC are designed to behave in a safe manner in case 
of this failure. The BMS operates independently and only 
reports health and status to the command bus. It also reports 
operational status directly to the independent annunciator panel 
in the cockpit. The CMC, however, relies on command inputs 
from the command bus, so the CMC includes safety features to 
allow safe operation of the X-57 aircraft in spite of command 
bus interruption. If command is lost from the throttle encoders, 
an internal CMC counter will increment. During an initial count 
up period, the last verified torque command is held and executed 
by the CMC. After a preset time, the CMC will execute a gradual 
ramp-down of the commanded torque to idle. These features 
enable continued operation for a short time after command bus 
failure, whereas the preset timeout prevents an indefinite 
running of the motors in the case of ground-testing when the 
aircraft is being operated remotely. As a mission-critical system, 
additional measures are taken to reduce the risk of various 
command bus failures, as detailed below. 


While the CAN standard makes the command bus resistant 
to EMI, steps are taken to further reduce the risk of the high- 
power systems introducing electric noise into the command bus. 
Mod II to the X-57 aircraft will locate the CMC and motors in 
the same location as the original Tecnam engines. Mod III to the 
X-57 aircraft, however, will require the command bus to extend 
to that point. As such, the FOBEs are used to incorporate the 
fiber optic cable segment between the fuselage and the CMC for 
both Mod II and Mod III. These FOBEs operate in such a way 
that they are invisible to the devices on the CAN Bus. The 
devices on either end of the fiber optic link behave no differently 
than if they were all connected by way of a copper bus. 


To reduce the risk of throttle command failure, the Baumer 
throttle encoders used to measure the angle of the Tecnam 
throttle levers contain a redundant encoder. The component 
transmits the measurement from each encoder onto the CAN 
bus. The components that read this information can then act on 
any discrepancies between the data reported by each encoder. A 
discrepancy between the two encoders is a case wherein which 
the CMC will consider the incoming command as invalid and 
revert to the command bus failure mode, as described above. 
Further risk mitigation for the throttle encoders involves the 
physical component. The initial design to digitize the throttle 
position used a cable-pull encoder. This method was revised to 
use a rotary encoder that has a direct mechanical connection to 
the throttle levers to reduce the chance of the cable snagging. 


The physical layer of the command bus also contains 
redundancy for the motor commands. The data from each 
throttle encoder component go to two CMCs on each side of the 
aircraft. To prevent a complete failure on one side in the case of 
a physical break of the command bus, the physical tie-in of each 
CMC connected to the same motor is located on opposite ends 
of the command bus. Therefore, a break on one side of the 
command bus ensures a physical path from the throttle encoders 
to at least one CMC on each side as indicated in Fig. 9. 


VII. FAILURE ANALYSIS 


The redundancy architecture described above minimizes the 
scope of single-mode faults, and the component testing will 
reduce the likelihood of faults occurring during the flight phases 
of the SCEPTOR project. These assumptions must be analyzed 
formally to ensure no faults with severe consequences are likely 
to occur at critical moments. A Failure Modes and Effects 
Analysis (FMEA) identifies the repercussions of each relevant 
failure. When coupled with overarching hazard tracking and 
emergency procedure development and testing in a full cockpit 
simulator with the X-57 test pilots, this approach greatly reduces 
the exposure to catastrophic failures. 
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Fig. 10. The X-57 command system network diagram. 


Motors 7, 9, & 11 


The X-57 FMEA was limited to single-point failure modes 
of the power and communication systems and identifies 
procedural mitigations and failure classifications. The analysis 
focused on top-level components and linkages and will identify 
unique failure case for each component. Some components have 
multiple sub-component-level failures, but their effect on that 
component and the rest of the system is the same; therefore, only 
unique failure cases are considered. The analysis began by 
constructing a full power and communication architecture 
schematic, shown in Fig. 10. 


The diagram depicts the X-57 airplane in the fully integrated 
Mod IV configuration, with the 12 in-board high-lift electric 
motor/propeller propulsors. The Mod II and Mod III versions of 
the diagram would omit the 12 inboard propulsors, as those are 
introduced as part of the Mod IV development. There is very 
little difference to the power and communication architecture 
between the Mod II and Mod III airplanes. A selection of the 
nearly four dozen X-57 Mod II and Mod III failures identified 
in the FMEA process are described in Table II. Mod IV failures 
also include all permutations for any specific inboard motor or 
groups of inboard motors, but are not discussed in this paper. 


There were two primary failure situations that the team 
identified as critically important for mitigation: asymmetric 
thrust condition for the Mod III configuration, and an in-flight 
battery fire. These two failures represent conditions that may be 
unrecoverable for the pilot. The X-57 system has many design 
and procedural considerations to prevent these conditions, and 
mitigation strategies for these situations are in place. 


The Mod III asymmetric thrust scenario is a condition such 
that only one of the wingtip electric motors provides thrust, and 
the resulting moment cannot be trimmed out with the rudder and 
elevators. The stock Tecnam aircraft can trim a one-engine- 
inoperable (OEI) condition, and the Mod IJ aircraft can trim an 
OEI because the locations of the propulsors and location of the 
thrust generation is the same. In Mod III, however, by placing 
the propulsors at the wingtips, the effective moment arm is 
increased beyond the capacity of the rudder to counteract. In this 
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situation, it is better to disable both propulsors (operating as an 
unpowered glider) than to operate only one motor. Depending 
on the type and severity of the failure, the pilot may elect to 
remove power from the operational side or de-rate to 50 percent 
(a condition which is still trimmable with the stock rudder). 


The battery fire or thermal event scenario is when one or 
both of the lithium-ion traction batteries are on fire or in thermal 
runaway. This condition is critical, as it not only degrades the 
power available to the motors for thrust, but could burn through 
structural members inside the fuselage. The battery features a 
vent system that segregates any ejecta or noxious gases from the 
pilot. Battery fire mitigation includes fire prevention methods, 
best practices from industry, and design features from the 
lithium battery systems developed by NASA for the 
International Space Station. 


These two failure scenarios provide a starting point for 
identifying component-level failures and their respective 
criticality status (safety-critical, mission-critical, or negligible). 
Table II describes a selection of the identified failures. The 
Failure Scenario Matrix was derived from the NASA Orion 
PA-1 project redundancy analysis. In the nominal case when all 
systems are operating, all systems are green, for “operational”. 
Each row describes a failure and the impacts on related 
components, shown with an F' (failed component), D (degraded 
performance) or J (inoperable) to show when a component 
failure impact other components. 


Each failure receives a criticality designation, which is used 
by the test pilot and operations engineers for mitigation and 
recovery strategies. Failures categorized as safety-critical, 
which are a direct result of an asymmetric thrust condition, a 
battery fire or thermal event, or a loss-of-power condition in 
which the airplane effectively becomes an unpowered glider and 
an emergency landing is unavoidable. For instance, the Battery 
Contactor (4x) scenario indicates that both contactors on each 
battery pack (a total of four) have failed in the open position, 
removing all high-voltage power from the batteries to the 
traction bus. The motor controllers and cruise motors therefore 
no longer have traction power and cannot provide thrust to the 
airplane, so they are shown with an / to indicate “inoperable” in 
Table II. Alternatively, in the Gen. bus (DC conv.) A||B scenario, 
one generator bus DC converter can no longer provide 14 VDC 
to the avionics buses, but the remaining one continues to operate 
nominally. No other systems are impacted, so this scenario is 
categorized as N or “negligible”. 


VII. CONCLUSION 


The SCEPTOR project is a rapid-execution, build-fly-learn 
experiment opportunity with a comparatively low budget and 
limited schedule. Careful design of the developmental systems 
and thorough analysis of these systems allow for a more agile 
project while still addressing the thesis that propulsion airframe 
integrations enabled by electric propulsion systems can be a net 
benefit to aircraft performance. Many of the X-57 aircraft 
systems are simpler than their commercial counterparts so that 
the research team can focus only on the handful of technologies 
that are being developed. The traction power system, however, 
is one major exception; this system is developmental and 
resources are limited, so careful consideration of the path to 
NASA X-Plane flight qualification is appropriate and necessary. 


TABLE II. X-57 Mop II AND Mop IIT FAILURE SCENARIO MATRIX 


Cruise Motor (1&2) 
[A] |MC/ inverter (1x) 
MC / inverter (2x) 
MC / inverter (4x) 
Pitch controller (s) 
Cruise Contactor (1x) 
Fiber Optic Modems 
Traction bus (A||B) 


Failure Scenario 

Single cruise motor 
Single motor controller 
Quad motor controller I 
Prop Pitch feather (1x) 

Cruise contactor (1x) 
Fiber Optic Modem I 
Traction bus AJ|B (LR) [D| 
Traction bus A&B (L&R) I I 
Battery A\|B (therm. evt.) [D| 
Batt A&B (therm. evt.) I 
BMS (L||R) I I 
BMS (L&R) I I 
Battery contactor (1x) I 
Battery contactor (4x) I I 
Gen. bus (DC conv.) A||B 
Wing av. bus A||B (L||R) I I 
Wing av. bus A||B (L&R) I I 
Operational [D] Degrade performance | I |Inoperable lia Component failure 

(Stand as soon as possible [M]Land as soon as practica [NJAssess after flight 
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